KQL Search

Query Details

HomeAI ToolsDevice Query

Dism Linux Subsystem

Query

Tags:

Query:
    DeviceProcessEvents
        | where FileName contains "Dism.exe" or   ProcessVersionInfoInternalFileName == @"dism"  | where ProcessCommandLine contains "Subsystem"
Refernces:

Explanation

Sure! Here's a simple summary of the query:

This query is looking at events related to processes on devices. Specifically, it is searching for events where the process name is "Dism.exe" or the internal file name of the process is "dism". Additionally, it filters these results to only include events where the command line used to start the process contains the word "Subsystem".

Details

Ali Hussein profile picture

Ali Hussein

Released: September 24, 2023

Tables

DeviceProcessEvents

Keywords

DeviceProcessEvents

Operators

DeviceProcessEventswherecontainsor==ProcessVersionInfoInternalFileNameProcessCommandLine

Actions